1

I'm guessing the answer is no here, but wanted to be sure. I would expect that when I get a database object or array using get_results that I still need to add htmlspecialchars() or esc_html() when placing the output in HTML. I did look at the function, but it's not really clear without finding functions that the get_results function uses (and not sure how deep I would need to dig). This question brings up one very small other question. Any reason to use the WordPress function esc_html() over the generic htmlspecialchars()?

0

The answer is: of course they are not - otherwise you couldn’t use them to save them in DB.

But... the answer to your question isn’t so easy.

Sanitizing is a process of preparing data for storing in DB. So for example if you insert some illegal characters in post_name, then it will be removed, so the post_name is sanitized, before saving. If you use color picker in Customizer, then you should sanitize it (checking if it really is a color and not some random string) before saving. And so on.

But sanitized data can still be dangerous. You can use “>” character in title, so title containing it will be sanitized. But of course you can’t print it in HTML of your code.

That’s where escaping joins the game. Escaping is a process of making data from DB secure for HTML code (based on context). Remember that the same title should be escaped in a different way when it’s printed inside tag (then you should use esc_html), than when it’s used as html attribute (you should use esc_attr) and so on.

So yes - you should always sanitize your data before storing it in DB and always use correct way of escaping based on given context.

  • Appreciate that. So it is not escaped in any way when retrieving from the database (that's the part I was mostly interested in). – tim92109 Jun 12 '18 at 17:30
  • @tim92109 No, it’s not. – Krzysiek Dróżdż Jun 12 '18 at 18:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.